Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 15:50

General

  • Target
    a328ac9e1a1348ab5a53a7745591a3a9_JaffaCakes118.exe
  • Size 808KB
  • Sample240817-s9y2sstdmb
  • SHA256 d9fd751d54221d8b28a99ce974fba4301121d89b7014346dc70aa8f9a2ec6a9c
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • benzwitich.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a328ac9e1a1348ab5a53a7745591a3a9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a328ac9e1a1348ab5a53a7745591a3a9_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Users\Admin\AppData\Local\Temp\a328ac9e1a1348ab5a53a7745591a3a9_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\a328ac9e1a1348ab5a53a7745591a3a9_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4028
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:392
        • C:\Users\Admin\AppData\Local\Temp\a328ac9e1a1348ab5a53a7745591a3a9_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\a328ac9e1a1348ab5a53a7745591a3a9_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2328
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3776
            • C:\dir\install\install\server.exe
              C:\dir\install\install\server.exe
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:3136

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          UuU.uUu

          • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
          • Size 8B
          • SHA256 35805255cbd323c1a1ff5793a07755c28d9a1be9b279308c9eda9e486d64c2d3
          • MD5 SHA1 SHA512

          XX--XX--XX.txt

          • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          • Size 229KB
          • SHA256 3f6f8b0fc55a7c10befbeb098863ad5ec3856126de8ed401b2de1fce796c532e
          • MD5 SHA1 SHA512 SSDEEP

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f03ff057abbd5be393c4117f56d47727be1c818506dfa2d7c3be8e4f6540d8a3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 45c443358bacce532a5708386c2acf56722e5e6c965bc651673d046d3c6721bc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dd2c0b30674c887c4a25ff782b4ff50fca967726db0c1c83d04441a2c20d2fad
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 33267f45ca6ee5e487dabd86922acd1920476578ab816fc1a623e3c07bdc24ae
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b89cc6bedbf445f2246be96b24e584b2384a704077cdacd0f8ad8ecf9c96a80f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2801e3f44f4719575ba685ecaac8040d18d4b82f044b10cf33189ec196f16b89
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7c982336e72819b68d9b2c26ba4885f8a7118b396d6adba43578c76a81f58a07
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ce1e98dccb87a5ffc547e1d53f4054026a5d9d4012959dab51edf6e4fb528773
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 da8bdbfc3e931edd61134df5a1d39ad825ef6fa79c0d38a90aacd9d09e616c07
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 21bea2ed8d3875ea85141502d95174c10d5e4930358142fc7cb9e8d7f0aaed6a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1c3cf13bcbe6ed181d7b934f3039c4f46322970b4ebaf8f07b7d28a65c79a005
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 18ccc8884001c304babdb4fb95e7de7bfcad7168807fed142409efb3263774ae
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cc5389b94f9e823ab2ff275645665031eb0520f7126d3ae88a2de737d19b441b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b3efb5c2ad7486eacb785b2c277f888d081e99960111863246f282228d7adf9f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3a809eaf0eee342d5966f91a1fb695e8e6ce77e10cf00a4e17b1111e71e47650
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f59eb95348407854ad0d073bcbda2d7bf35663ac1817fac7c31dcac7b23e013b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b329b388e848075562b71b02a412def7f85055a0f7f800647b8cc761ca028221
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 552c163a46b6dc3adcc095926d2516bbe95d01d91c982cdc437dbaf28cad499d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b122527da6324d3d8e328e36b6a19f6070a87b8c6607635fe72b3168454c3c64
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6f099f3d84facbed841eee819c322b65315efd4847e115bb55004c16062913f4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 89fa2885a27fb7308ce8d7be9e14e912b2099bc7e4aa98a47af5dbb194ff5ed0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 681f3fa3eb5444a624c1b4e589c9ebe4f059b848664eef79e42b6ff2422f39a7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 afd71ca866c3d2e8277407c1d2dd892ffa89411cbe1a2e09f1b7da731eeb9525
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cc94352946d3add72e28c8b644c631db6b30de929a8eb37f09135286c882127d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 94c1ae1248592209dc25636fdc83d0e7f6fab99181165a08bac3455778c4659e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 441ef73dc51cb1d7e7b9a16f8bcf5f2f165424762534bd2cd537841456bfa1aa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a151de0681257f36e8e950ab334f2d581659f20f4d9112477221e7a82722a384
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7b0275e68bce79ba8c835dd9b4346406872ed997ec6c5c8c45d3978078d6eb65
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 20232ceae677dc5d4067bfd05a27ecafd2765a3663ad8cc3a3b960698c25621f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 91702f57a058f93828dffdccec94f0143400cd0c705a89b511f437e93703df19
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 65094a9d21e4e8affba2ab601339ddee218b7b30fac62f585fc3483763c0c9dd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0d9c9dee25436cfe7ac17c1eba8e27d7de941fdcf046961fdbfc3d867ca2aaa3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dd86381d37ca5c450a3c258f4068906892994cfefabed07f7fb3195361324dd8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c6aedabc0b762a60a85546dc493a588769e23868a1139d492373b86f3c6ebfcf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4770dc1959ed903b9cb1431fad6682e8d46f56d22b744e76c54ada9d12e74a7c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b2dd0f445852becd5ddd2e13535fa71e7be967277c1874e7e9166af241ff3e23
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 43013cc081ea85f0886753e2f8609a228be196db6ab2cb56537e071e87dd7aec
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a248c1379802deb819d916350e59dcc2d7dcd8d020bb692e64e26512548c248e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9e0048959b8d31bbb2a29c50ef983bc79c4cc76d6163e1fb9409278b380518b6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 41f1691075770cdc8e0a60b1f8c4768d1d19e4be640494a8ef9384a349fadb1b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 437356da9abe01c10781f8f534090034357f89898fd8919de77874484144991e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6661cded19a5065ed9803444fb2c59812dc8adf50c9f2a9b04a7d111dba08e7a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6f1744c7232d0e7196dda528c54ee7ad05dc802c90f7f53d9754dd2d145e5796
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f3255dc8a79e7ca0f76af5fc389f2beb94f933278885fa6eaa0fce129bafab96
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2f294779e2ed6ab8270b62b52ebae42d29fe857abe2d3cf74cac79a50e5597d1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7b7fd21e3677cabcabb56c4bc76ff79a874d27b9a7c68b3bda8ddcd3c98d2b49
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a97a0642607c6783783bd22741d06096de14c0b2e1758c5da0dacd68ddcb2c85
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0b927b5dc4d06a2a748325aacba02a2043fa3bca7af9c6382a7cd3a24505a6e3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bfd65f11f14eb057bb6b345cba7e1c4764250baa049db5e89dd9d057b54a470b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b9350494ecaf6ccbcb68ad746687e33f8112c47f787b99c16ea889566d4506c1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 52983e9fa492271b8f4ecbecc08ecc4d820be4b708c2f230582d9ef6757a6153
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a9826b9a9ee3205fb36f93420a41b0b1aa7b9109e46eb78c3bb3897bd6695c35
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 101de78c544d1d88e3d97310caec4a8641a49786b9274cb064d8be0746f47269
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a4d574943f2082e1d344df1b15d0e11ee54554a53d9a8a1c21bbae7b666ce351
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a5c78207fe361d5ff4ce0b682da8f72ef29d5a01ac6314b6b071bd141f8ebf07
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 794beebb5af9c9b8a201b2339087c6dbbf4b6ddf0d083f5cf0c7d3f42e36d86c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a7f836912f8aaa8b95677dce81d41709d64fa393e7bd7c3754c6a761c6205913
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7f1509f148c41d55b969d50e7a944f5fef1662b5922b795bd3b2441105818382
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 52568c128e72f5b879e4a3f08052a5e9876b1316a1230d715e7c7ae5be5e7b9a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9457e785e2c98c532658e5c617c6ef666293c1db0284197a438a597c0bc5d229
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4fdd8966b5d0cff2304c52d138ad6e69fb88f905a7aed9d8a691b1b0d8a1b316
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9ed262345d7bcffc268d5af5c929563583ea3b5d0b046746427085284b623607
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e9553965bb3bb24bc22ca0a22211e47aeaee94a99ace7b3be87ba0f663291458
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0610dd5f81cc4ca914f3f946d3623ad10c19e9c496658c64aea32443c2ed703a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bb7a8e705684274c56d279825d43178b2535fbacea166963ff7b89d1147c8643
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4f2b10cd702b15e9c9689d93ae5d3f4ad647be3c48962080e33a886926393b0c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 71afc443b5585e580cd1a2e3c6a63f78dc45c3e33eb266932524a18a2d938663
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3cdf2f559b4f213f793cea93f7a5a98e30d17f35b753d32f934d28f189bc5959
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d0db95f1622fe8c84c0051e04cd199b3c89f7b23a92d6453ae1d866a243ee270
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ea39068529034f018a890febc818bbd01404f110b42ffd056aaa622eb40074a4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 11bfd6e9fd34708f8f36a6382c0aeff74ecd29fcc342944ff69abb0106e85d25
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e1101546d21f1ecc8a87ca82c2d0138e6e6a75fb1c7447cf88e54c8736755336
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 272bc75b4d1de96803afe378d1cbbc383e16d3ff635fae3b413f7815a8e0ea39
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9807f5ade2f0e66f8c4eaa58bd3007723ebe922418e66f39b37bf598719a71f3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a442f674db2d2012bf8534832252e1779e1fdd179488aedbe7938c8f07705bac
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 06c6b7879e6a3b65ed66b4479debb87fde87c4a5525ecc995a95c0269c710663
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 da59580655c92433f56e15c50cea0ba14c2b2d443db15ccef5a02d92efe8de9e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 62fa10eae8a742667c28c5102ae34ac01657ae19e9bee4a6cadd306b6d82c48d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c148b88bdc9bca06e63aea398457c12871d5cc44b3362189ce1e3ebf812b9c29
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 60151352ddab178bbfa86889cac72b9691376ae2a10c9312be651fbe4b3a2afb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7379c53938470072895eec6843f2b775ed0ecd5b51456299a1d6ce6ecebf7555
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a75b7ec87ca76fa5c29694ccdc887b92d7000d34d952a8aee3d659b81bb49b14
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4a092a082f93318af54752b67c3a786e28d2735ef8747b4e79fa34d6b4f67fd8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e89fdaac96d3e56181592721c09c5ae1f28462472499d39b67a5e2bd94e56343
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 712e3e59fdd780cf2688d0f83b700e9d74275444242a493cab28c55cea6a64f9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 45ae93d912faf01c1a458fee6fc20d10b5e78b72ac92a95294bf913bbec8bff9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 18a437f83ccaaa3de0a8451176bee55dcf7f71855ba186c31f57a789c887471e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1202ba5ea0dae15ae8a6ac7a0015609d08f862ee30945f3eb958f4bbe42039af
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2fe787a28ac42010c5d8e4cc7bc2ab74ec5556ec0e0dd26136e4fad59bafe084
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d99de8e6ce49e5385e837f603f7bf7abe5ea4038d0a4785f50099be420d9aaa4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 77179220d00e2a7e1bc805b48acdce933bd2be739dcd09a64d696a35c66d3a36
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8a1e24a94245229e24b95393e2725da3a6b183746f104d8c12c56295b5970245
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2f1b33677ef7f5ccff7e9e8713ed8063789f94d8fee8d25828afc3c6ff5f4052
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c4ef235abdeb757f2c098a474f08f3b924c393be3fff59d4c1c26fcc8424f36f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ff0eb2d5d8cae457b0cf0f7f5407e01d6edda50998bd0542122334087897ff6a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4d307ae5d55e75f1de2e65ca6fc85fc7d3e0d2f07c4d0ac8e2a931f51a470fc3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 96d6ef2a1f1dac38554017919868a332d69a4d715d7f2bcac67eadc4c6f861f2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fee42309f83671c6770a2ad573a19540e46c92a4402dac034e13dc0feaa045b3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 90ca7f2e8759d1d91210f4461ae2551527f64c76049c896f78c0137dc55aa6d0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 87f8b61ba371d446d18b70cc6f75a77717328c550430121978ed8e78705ee10e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0c186da3a1fc546e04641a20f34ac20722a80e3c5caab64a79c889f9acf95986
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b4dd6ee99d4c238f76a048477da30c6fc755753ba9f75184847265ff8fde1fe0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6029f054d1dea1dc46e149b81e7724245d3c4c4d3bc644497eb9edea220f9432
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e4282d1e3938a11d40929e9b157b3fe56adf940c878b66f0cabb1f3bf6aa4541
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 91b52c3fbdc83f2ef8ebd5936834198f6c2b67551f2a16e992e0154cd4b778e2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 446a9e128ee39301d0e7c69a28d93b31f4b5df787026d09baf3ec6bb4b84868a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 527a54ddedd7ddce446e2a6a0709e4a954af115023c5aa8654dacfb741f5ff0a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5f3210a6f4739824ae19098661dd532ad001480233a20e96c78619c58619442e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f7029e0ad8673547218f220c4d1f042cf791994d72840f4269db6b0f4749f4ba
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8c7351f702d4c86cb058646409506b360af0af6f339b9ad11eeedb672f815390
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4c0f4b5f9b069df25129699527c1615ed562dd30013febac6277ad3b6304f70c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 98c29375f16656336a3165a63e17a0fb5f0fa5509e8d1efb36bcb94c22f65cb8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3cfb2c889f05dc1bf6492853709a6fd89ad4f06eed9d6d701490dd81ef3b5fca
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dd4483e9690ec074398848886f59dfd326f1f3291ab6d19125712c60f0f6448b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b45ec44dd8a56bd3ab089e703f609eaa5b5bfeb683d22cf8b3b894f3bbbd7d90
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 de73855a2aa90a9d6dbbfe1feade95eca37eea2c64ed3aa23f782bedc7f46ad0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 01461ef8430b789eeae8b617f63b2ea9982bb2e9da9ae422dabebc51e3e790b8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fd8d36aa8a77f8903101ba6a8f77b903e8c5dd541bef0bf2b998ed8a93dcb9c8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 83c670ec7234de1af83b8b50082d4078ff8d1a66ca6dc9e8786d48192b5ba2d0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 88238084feabd1544dbc03dc9c60ff856a9fce6417e17ac99ea0db885f3b6d75
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f33554c95d71a307d9ff97b044acaa18baca1627eb7ea2b2e04c4781fc79e950
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4c8520f48977fa5c206f4958ab9d6907e052841c47965ae0deda3f09d8ef6a7f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 208e34113d920f9deaa23949d798980fa31cb2b6ee1b36bc96fdb37a7a725224
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 262313d87067256f0304946b422f46ae7d8c1c11263379cd1ad2dfd751cfe230
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4d398e3db643bd0a71669aa7c2df525447aa267810b87385739c2b15cccac10f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bd6a0d2f68508ac3f9b7dbae74b1243009b9c62c8d348b9e9d1e37970da8e68f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 564277bd70f16df36618b023f792c3bfaca6fed22bac289a38c388950ceedaef
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4db89a18f963b695d27e010e2e10793f61bcbb604d231b38581c0521eb5bc674
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0827a472b0a9466f3f2fb024a99234c7f1086afc57a58487fa2b6ef3cb4478b8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 79799d5e1611d9cf274bcb2821181ccc82e52fb63a1fa829282b5ed154f10fdc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 732ded6fddc55505a82fdb4ebeab1c1523f0b2a5f0a2569b3a2f242ff68c674c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 07e35dde23150e9328c2e832f1e50e7b1276f9d8c71f6e9f814a6d5bf4542434
          • MD5 SHA1 SHA512

          logs.dat

          • Path C:\Users\Admin\AppData\Roaming\logs.dat
          • Size 15B
          • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
          • MD5 SHA1 SHA512

          31-05-2011 00-27-14.png

          • Path C:\Windows\SysWOW64\31-05-2011 00-27-14.png
          • Size 48KB
          • SHA256 e36d8242afb1842c026355a837dde82605694cdd7477a5d95de418375bf66988
          • MD5 SHA1 SHA512 SSDEEP

          eax.dll

          • Path C:\Windows\SysWOW64\eax.dll
          • Size 184KB
          • SHA256 b2da4f1e47ef8054c8390ead0b97d1fbb0c547245b79b8861cfa92ce9ef153fb
          • MD5 SHA1 SHA512 SSDEEP

          server.exe

          • Path C:\dir\install\install\server.exe
          • Size 808KB
          • SHA256 d9fd751d54221d8b28a99ce974fba4301121d89b7014346dc70aa8f9a2ec6a9c
          • MD5 SHA1 SHA512 SSDEEP

          memory/2328-49-0x00000000001E0000-0x00000000001E1000-memory.dmp

          memory/2328-50-0x0000000000740000-0x0000000000741000-memory.dmp

          memory/2328-151-0x0000000000400000-0x00000000005DD000-memory.dmp

          memory/3136-154-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/3136-145-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/3776-147-0x0000000000400000-0x00000000005DD000-memory.dmp

          memory/4028-44-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/4028-37-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/4028-112-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/4028-38-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/4028-45-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/4028-48-0x0000000024080000-0x00000000240E2000-memory.dmp

          memory/4028-41-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/4480-11-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-28-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-8-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-10-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-29-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-12-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-13-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-14-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-15-0x0000000002520000-0x0000000002521000-memory.dmp

          memory/4480-16-0x0000000002520000-0x0000000002521000-memory.dmp

          memory/4480-17-0x0000000002520000-0x0000000002521000-memory.dmp

          memory/4480-27-0x0000000002520000-0x0000000002521000-memory.dmp

          memory/4480-30-0x0000000002520000-0x0000000002521000-memory.dmp

          memory/4480-32-0x0000000002500000-0x0000000002501000-memory.dmp

          memory/4480-34-0x0000000000400000-0x00000000005DD000-memory.dmp

          memory/4480-40-0x0000000000400000-0x00000000005DD000-memory.dmp

          memory/4480-0-0x0000000000400000-0x00000000005DD000-memory.dmp

          memory/4480-7-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-26-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-25-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-18-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-19-0x0000000000400000-0x00000000005DD000-memory.dmp

          memory/4480-20-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-21-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-22-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-23-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-24-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-9-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-5-0x0000000002520000-0x0000000002521000-memory.dmp

          memory/4480-6-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-4-0x0000000002520000-0x0000000002521000-memory.dmp

          memory/4480-3-0x0000000002520000-0x0000000002521000-memory.dmp

          memory/4480-1-0x0000000002510000-0x0000000002511000-memory.dmp

          memory/4480-2-0x0000000002520000-0x0000000002521000-memory.dmp